Security hardening at the foundation

Stored XSS fix across the SDK stack

The most critical work this week spans multiple Clerk packages that share a common SSR pattern. Three releases — Clerk JavaScript SDK, @clerk/tanstack-react-start, and Clerk Astro — all patch the same vulnerability: user-controllable session claims containing </script> could break out of the SSR <script> tag where Clerk serializes auth state, enabling stored XSS. The fix escapes <, >, and / during serialization while preserving identical JSON values on the client. If you're using any of these SDKs, the patch is a recommended upgrade.

Hardening IPC, session tokens, and TLS

Clerk's Electron SDK v0.0.16 validates that token-cache and OAuth-transport IPC requests originate from a top-level window's main frame, preventing a subframe or <webview> that shares the Clerk preload from reading the persisted client JWT or driving the OAuth flow. Meanwhile, @clerk/backend v3.11.7 rejects machine tokens (M2M and OAuth JWTs) presented in the __session cookie — previously such a token could pass session verification and produce a signed-in state with a machine identity as userId, defeating if (userId) authorization checks. On the infrastructure side, Clerk announced that CBC-mode TLS cipher suites will be removed from Clerk-managed subdomains in January 2027; clients that can only negotiate CBC will fail the handshake when certificates rotate.

Faster failure recovery and platform polish

The Clerk JS SDK v6.25.3 and @clerk/shared v4.25.3 introduce timeouts for Frontend API requests during load — if the FAPI is slow or unreachable, the client aborts the hung request and renders identity from a freshly minted session token in seconds instead of hanging while retries run. The same fix also prevents useUser() from retaining a cookie-derived stub user after full user data arrives. For Vercel customers, @clerk/backend v3.11.6 and the Next.js SDK add CLERK_DISABLE_AUTO_PROXY=true to opt out of automatic Frontend API proxying on production deployments.

Elsewhere, Clerk Expo v3.7.7 fixes Android native UI component crashes after navigation detaches and reattaches, and Clerk UI v1.25.5 fixes Escape key behavior in the Drawer component. The Clerk iOS SDK adds cross-app sync support, and Supabase Auth introduces experimental provider linking-domain groups while downgrading session AAL after admin deletion of MFA factors. The Auth0 dashboard now supports real-time Role search by ID and name in public beta.